AWS CDK でLambdaオーソライザー（トークン）を実装して認証を試してみた

lambda-authorizer/
├── bin/
│   └── lambda-authorizer.ts
├── lib/
│   └── lambda-authorizer-stack.ts
├── lambda/
│   ├── authorizer.ts
│   └── backend.ts
...

import { APIGatewayTokenAuthorizerEvent, APIGatewayAuthorizerResult } from 'aws-lambda';

export const handler = async (event: APIGatewayTokenAuthorizerEvent): Promise<APIGatewayAuthorizerResult> => {
  // ① 認証トークンを取得
  const token = event.authorizationToken;

  // ② 認証ロジック：トークンが'allow'なら許可、それ以外は拒否
  const effect = token === 'allow' ? 'Allow' : 'Deny';

  // ③ IAMポリシーを返す
  return {
    principalId: 'user', // 固定のユーザーID
    policyDocument: {
      Version: '2012-10-17',
      Statement: [{
        Action: 'execute-api:Invoke',
        Effect: effect,
        Resource: event.methodArn,
      }],
    },
  };
};

import { APIGatewayProxyResult } from 'aws-lambda';

export const handler = async (): Promise<APIGatewayProxyResult> => {
  return {
    statusCode: 200,
    body: JSON.stringify({ message: 'Hello from lambda API' }),
  };
};

import { Stack, StackProps, aws_apigateway as apigw } from 'aws-cdk-lib';
import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
import { Runtime } from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
import * as path from 'path';

export class LambdaAuthorizerStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // バックエンドLambda関数の定義
    const backendFunction = new NodejsFunction(this, 'BackendFunction', {
      runtime: Runtime.NODEJS_22_X,
      entry: path.join(__dirname, '..', 'lambda', 'backend.ts'),
      handler: 'handler',
    });

    // Lambdaオーソライザー関数の定義
    const authorizerFunction = new NodejsFunction(this, 'AuthorizerFunction', {
      runtime: Runtime.NODEJS_22_X,
      entry: path.join(__dirname, '..', 'lambda', 'authorizer.ts'),
      handler: 'handler',
    });

    // API Gatewayの定義
    const api = new apigw.RestApi(this, 'MyProtectedApi', {
      restApiName: 'MyProtectedApi',
      description: 'API protected by a Lambda authorizer',
    });

    // Lambdaオーソライザーの定義
    const authorizer = new apigw.TokenAuthorizer(this, 'MyLambdaAuthorizer', {
      handler: authorizerFunction,
      identitySource: 'method.request.header.Authorization',
    });

    // バックエンド統合の定義
    const backendIntegration = new apigw.LambdaIntegration(backendFunction);

    // リソースとメソッドの定義
    const helloResource = api.root.addResource('hello');
    helloResource.addMethod('GET', backendIntegration, {
      authorizer: authorizer,
    });
  }
}

curl -i -X GET https://{API_ID}.execute-api.ap-northeast-1.amazonaws.com/prod/hello

HTTP/2 401 
~省略
{"message":"Unauthorized"}% 

curl -i -X GET https://{API_ID}.execute-api.ap-northeast-1.amazonaws.com/prod/hello \
  -H "Authorization: invalid-token"

HTTP/2 403
〜省略
{"Message":"User is not authorized to access this resource with an explicit deny"}

curl -i -X GET https://{API_ID}.execute-api.ap-northeast-1.amazonaws.com/prod/hello \
  -H "Authorization: allow"

HTTP/2 200 
〜省略
{"message":"Hello from lambda API!"}